Hole in Linux kernel provides root rights

http://www.h-online.com/open/news/item/Hole-in-Linux-kernel-provides-root-rights-1081317.html

by spahl • 16 years ago

69 32 16 years ago

h-online.com

bustamove2• 16 years ago

just tried the exploit on my slicehost box and it successfully root it!

bustamove2• 16 years ago

~# uname -a Linux slice 2.6.32.12-rscloud #26 SMP Mon May 17 12:35:34 UTC 2010 x86_64 GNU/Linux

jsean• 16 years ago

How come Robert sucks?

edit: ok, if you didn't notice source's filename; http://sota.gen.nz/compat2/robert_you_suck.c

And just in case... also ;)

psiconaut• 16 years ago

ea = [robert, tavis, ben]; assert uploader in ea[1:] :p

Somewhere in the kernel, 2008: "hey, what are these lines for? nah, we are safe removing them..."

edit: robert is the author of the original exploit, that resurfaced when ben found the patch had gone from kernel.

blasdel• 16 years ago

There's a tradition of ridiculous file names for these things, like jessica_biel_naked_in_my_bed.c

viraptor3• 16 years ago

Both file names and nicks really - Przemysław Frasunek listed in the code is (was?) also known as "babcia padlina" (grandma carrion)

leif3• 16 years ago

From that file, this guy http://swiecki.net/index.html is mentioned a few times in the comments, I'd guess it's him (perhaps this is what the other reply to this thread meant).

jacquesm7• 16 years ago

Strike one for regression testing.

I tried the exploit on all our 64 bit boxes and it seems to fail on every one of them.

Here are the uname -a strings from a representative sample:

Linux c01_04.ttc.com 2.6.17.11 #3 SMP Wed Oct 10 06:16:52 EDT 2007 x86_64 GNU/Linux

Linux root-desktop 2.6.31-16-generic #53-Ubuntu SMP Tue Dec 8 04:02:15 UTC 2009 x86_64 GNU/Linux

Linux eleven.ttc.com 2.6.15 #2 SMP Thu Mar 9 09:06:54 EST 2006 x86_64 GNU/Linux

Linux backup01.ttc.com 2.6.25-14.fc9.x86_64 #1 SMP Thu May 1 06:06:21 EDT 2008 x86_64 x86_64 x86_64 GNU/Linux

On the last one it exits with 'symbol table not available, aborting!'.

Off-topic, how many of you actually review a program like this before running it?

viraptor3• 16 years ago

I try to. Most of the time if you see a #define that is not a simple constant in an exploit, it should be at least preprocessed... There are a lot of "ssh exploits" that are really `rm -rf /` wrappers with some interesting preprocessor abuse.

jacquesm7• 16 years ago

That's what I do, I run it through cpp first and read the code from where the include files end, just to make sure someone isn't social engineering me into doing something stupid.

In case anybody wants to read the code preprocessed it's here:

http://ww.com/robert_you_suck.txt

Now of course you have to assume I'm telling you the truth, but that's easy enough to verify.

Paranoia has no limits ;)

jrockway2• 16 years ago

In this case, an evil system administrator could change the text of /proc/kallsyms (probably via a hacked libc and LD_PRELOAD, or just the hacked libc) and then execute arbitrary code as you, because the exploit code uses an unchecked write into a stack variable (and who compiles their exploit code with a stack protector).

I am almost tempted to do this, use the exploit to get root on my work machines, and then replace the libc... just to see if anyone else tries the exploit. (Note to the literal: not really.)

execv("/bin/sh -c 'for i in `find $HOME`; do echo "rm -f $i"; done', 0);

leif3• 16 years ago

I usually review but don't run it....

jacquesm7• 16 years ago

:(){ :|:& };:

Tempting though, isn't it ?

X-Istence2• 16 years ago

Which exploit are you running? The one that was posted on full disclosure: http://seclists.org/fulldisclosure/2010/Sep/268 includes bypasses for selinunx, and used to include code to bypass grsec.

rbanffy3• 16 years ago

Anyone would like to explain why stuff like this is not automatically tested? Introducing tests into the kernel source tree would actually help its development and prevent incidents like this, wouldn't it?

mfukar2• 16 years ago

How would you go about testing system calls?

rbanffy3• 16 years ago

Why not?

I understand device drivers cannot be easily tested (unless we write accurate hardware simulators, which can be done with a lot of effort), and the same happens with time-critical stuff (that could be solved with even more hardware emulation) but this kind of stuff (checking if a known exploit fails) could and should be tested in automated fashion.

Not everything can be tested reliably and automatically, but what can, should.

RexRollman• 16 years ago

It's open source. We are all testers.

rbanffy3• 16 years ago

That's not an excuse for not having proper automated tests in place.

jrockway2• 16 years ago

Incidentally, there are several buffer overflow errors in the exploit code.

amackera• 16 years ago

Exploits for the exploits?

Hole in Linux kernel provides root rights

Related Stories